Client-Led Session: A federal practitioner shares real-world insights from running the Dragos Platform in a federal environment. Roadmap & Product Direction: Chuck Weissenborn, Federal Field CTO, walks through what's coming and answers your questions about the platform's evolution. Open Mic Feedback: Direct conversation with the Dragos team about what you'd like to see next. This is your chance to shape the direction

2026 Theme: Origin Story
Every defender has an origin moment: the moment they realized the system watching over them wasn't built to see what actually mattered. For the people in this room, that moment wasn't cinematic. It was a 2 a.m. dashboard reading normal while something wasn't. It was a generic IT tool that couldn't read their protocols. It's the moment they stopped trusting the all-clear and started trusting the judgment no generic IT tool could give them — and it's a large part of why they're still doing this work today. Tonight, we want to recognize the practitioners — shining the light on the real heroes that are safeguarding civilization daily.

Costumes optional but encouraged. 

The OT threat landscape is changing faster than most defenders realize. Bryce and Caitlin cut through the noise to deliver a calibrated, data-driven picture of what adversaries are actually doing in industrial environments right now by separating meaningful developments from hype and helping defenders understand where to focus.

Key Takeaway: Walk away with a clear-eyed view of the 2026 threat landscape and which adversary activities actually demand your attention.

Default credentials and undocumented backdoor accounts are among the most pervasive and underappreciated risks in industrial control systems. Reid presents a practical, generalizable methodology for detecting their use across proprietary OT protocols by giving defenders a transferable skill they can apply far beyond a single vendor or product. 

Key takeaways: Leave with a detection framework you can adapt to any proprietary authentication protocol in your environment.

When an OT incident happens, the quality of your response depends entirely on what evidence you can collect. Drawing on real incident response engagements across multiple sectors and regions in 2026, Natalie and Jan walk through what artifacts actually matter, how to collect and validate them under pressure, and how to build artifact readiness into your program before an incident occurs.

Key Takeaways: A repeatable OT artifact collection framework you can start integrating into your IR planning immediately.

AI-equipped adversaries are coming for critical infrastructure whether or not defenders modernize, and the way to prepare is to be that adversary against yourself first. Garrett walks through how Dragos pointed a frontier model at its own products and infrastructure, why getting AI to find vulnerabilities turned out to be the easy half of the problem, and how to build a verification layer harsh enough that you believe what survives.

Key Takeaways:
A practitioner-level blueprint for standing up your own adversarial AI program, including the design decisions that kill most candidate findings before a human ever sees them.

AI is changing how adversaries work, but probably not in the way most headlines suggest. This session cuts through the hype with real examples of AI-generated tools observed targeting ICS environments, and delivers an honest assessment of what AI actually enables for attackers, where human expertise still matters most, and what it means for defender timelines.

Key Takeaways: A grounded, evidence-based framework for thinking about AI-augmented threats in OT, and how to adjust your detection posture accordingly.

The most dangerous entry points in OT environments are often the ones nobody knew existed. Hussain draws on a deep dataset of recent industrial incident response engagements in 2026 to show how shadow OT and unmanaged third-party access are giving adversaries reliable footholds, and what defenders can do to find and close those gaps.

Key Takeaways: A practical framework for identifying shadow OT exposure and evaluating third-party access risk in your own environment.

General-purpose AI models weren't built to understand OT. Alex explains why that matters, how Dragos is approaching the challenge of building AI that genuinely understands industrial environments, and what becomes possible when machine learning models can reason about OT assets, vulnerabilities, and operational context the way a seasoned analyst does. 

Key Takeaways: 

An accessible, practitioner-level look at how purpose-built OT AI works and why it produces fundamentally different results than general models.

You can't protect what you can't see, and the data shows that most organizations are seeing far less than they think. Nithya delivers a data-driven reality check on asset inventory gaps across manufacturing and transportation environments, and presents a structured approach to closing the visibility gap using automated discovery and enriched device-level context.

Key Takeaways: Concrete benchmarks for where your asset visibility likely stands, and a roadmap for getting to a defensible inventory posture.

A Dragos-tracked threat group has been quietly compromising critical infrastructure organizations in India, and its own operational security mistakes gave it away. Sam walks through the group's activity: who it targets, how it gets in, and what it's after. He also shows how threat hunters turned those OPSEC missteps into persistent visibility into the group's operations. Attendees will leave knowing how to defend against this activity, and why an adversary doesn't need to be sophisticated to succeed.

Key Takeaways: Learn the inside working of an unreported threat group targeting India's critical infrastructure, exposed through its own OPSEC failures.

Insider threats in OT environments keep executives up at night, but hard data on what actually happens, and what actually prevents it, has been nearly impossible to find. Dawn draws on decades of insider threat research and a new study of real OT insider cases to give defenders the evidence-based framework they have been asking for.

Key Takeaways: A grounded, case-driven understanding of insider threat risk in OT and the controls that have proven effective in practice.

Who Should Take This Course
Analysts who already have hands-on experience with the Dragos Platform and are ready to use it in an operational role which includes triaging detections, working notifications, and running investigations day to day.

Level: Intermediate–Experienced
This instructor-led training builds analytic skill through lecture and labs. You'll work through the same theory and hands-on scenarios an analyst faces on the job. This is not a product overview.

Requirements and Testing
Bring your own laptop. Before the event, test our lab environment here: labondemand.com/Launch/949F2C16
Run the test on the device you're bringing, from a neutral network such as homehome, not office or VPN. For connectivity details, see Skillable's lab connectivity guide.

Who Should Take This Course
New Dragos Platform users who need working knowledge of the platform before they can use it effectively in their role.

Level: Novice–Intermediate
A one-day, instructor-led training that gets new users hands-on fast. You'll work through the four primary use cases with realistic scenarios, building the skills to run the Dragos Platform confidently and strengthen your ICS/OT environment's security posture.

Type of Session: Instructor-Led Training
Audience: New Dragos Platform users
Prerequisite: Know which version of the Dragos Platform your organization runs

Special Requirements for Training
•    Customer portal account
•    Internet-capable laptop
•    Power supply
•    Recommended: travel monitor and mouse